Lmst

How is @hrbrmstr following me!

Wordle 1,460 3/6*

⬛⬛⬛⬛🟨
🟨🟨🟨🟨⬛
🟩🟩🟩🟩🟩

Heyyyyyyyooooo will I see you there? https://infosec.exchange/@greynoise/114705972695631920

@hrbrmstr brb, I'll get an abacus and Haskell going...

Err on the side of caution today. Someone handed me a bottle of water (because it’s >100°) and the seal wasn’t sealed completely. Likely fine but not going to find out.

Double check everything #AI :)

Just a totally normal trip home from the airport last night… passing the national guard rolling down the highway as they prepare for NO KINGS DAY protests. F this administration. About 3 more months before they start trying to censor social media via tech controls.

@hrbrmstr wait wait WAIT then how are you ALSO here??

@heymarkreeves I verified before sharing. 👍

@hrbrmstr busted

Glenn 📎 boosted:

🚨 This is some VERY IMPORTANT INFO to read about malicious MCP servers by the VirusTotal team @ Google.

https://blog.virustotal.com/2025/06/what-17845-github-repos-taught-us-about.html

table titled "ATTACK VECTOR" & "EXAMPLE INDICATORS" that outlines various Model Context Poisoning (MCP) attack methods and their warning signs.
The attack vectors listed include:
Malicious-Server Supply Chain - Self-update scripts, install hooks from non-canonical URLs, latest tag pulls.
Rogue Server / Impersonation - Hard-coded IPs or typo-squatted domains, no TLS/mTLS verification.
Credential Harvesting - Code that reads ~/.aws, Keychain, or env vars and posts to external endpoint.
Tool-Based RCE & File Ops - subprocess, exec, or rm -rf paths built from LLM/user input.
Server-Side Command Injection - Server concatenates JSON-RPC params into shell/SQL without escaping.
Semantic-Gap Poisoning - Manifest says "read-only"; implementation writes files or opens sockets.
Over-broad Permissions - OAuth scopes */ "full_access", multiple data silos bridged in one tool.
Indirect Prompt Injection - HTML comments, zero-width chars, or Base64 blobs returned to the host.
Context/Data Poisoning - Unvalidated web-scrape fed straight into context= parameter.
Sampling-Feature Abuse - Server requests giant completions before any other call; leaks system prompt.
Living-Off-The-Land - Malicious server does nothing but orchestrate trusted tools already installed.
Chained MCP Exploitation - Output from Server A becomes params for Server B within one loop.
Financial-Fraud Tools / DoS / Persistence - Payment APIs with LLM-supplied dest-IDs, infinite loops without rate limits, hot-swapped binaries.

Seems like a lot of work when you could have found 200 year old brain proteins in the US Congress rn.

https://phys.org/news/2025-05-paleoproteomic-profiling-recovers-diverse-proteins.html

@dpendolino

Wordle 1,439 4/6*

🟩🟨🟨⬛⬛
🟩🟨⬛🟨⬛
🟩🟨🟨🟩🟨
🟩🟩🟩🟩🟩

It's hard to beat good deception. :) https://infosec.exchange/@greynoise/114585708292992374

Glenn 📎 boosted:

We are back this Thursday for another GreyNoise University LIVE, tune in for demos, news + what to expect this month! 🔗https://www.greynoise.io/events/greynoise-university-live

How do you officially request a pickleball emoji? I bet @hrbrmstr would know.

If you're ever feeling lonely, just close Zoom.
This works because a funny thing always happens: a random last-minute Zoom will appear if you close it completely.

@dpendolino

Wordle 1,436 6/6*

⬛⬛🟩⬛⬛
⬛⬛🟩⬛⬛
⬛🟨🟩🟨⬛
🟨🟩🟩⬛⬛
⬛🟩🟩🟨⬛
🟩🟩🟩🟩🟩

Can verify
https://mastodon.social/@hrbrmstr/114559022554295467

Client Info